Splunk Search

Join only giving fields from one of the two sourcetypes

asarolkar
Builder

All,

I have a join on the two sourcetypes setup like this ->

sourcetype="alog" -> id_number

sourcetype="blog" -> id

This is what my join looks like

sourcetype="alog" id_number=* | eval id=id_number | join id[ search sourcetype="blog" id=*| fields id]





For some reason, this join is only giving me results/fields that belong to alog.
What if I want the join to also give me all fields from blog whereever there was a match ?

I thought Splunk supported outer joins.

Any clues ?

Tags (3)
0 Karma

jonuwz
Influencer

You need to specify join type=outer

docs

Update

Just noticed - the only field you're returning from the subsearch is id : fields id

So the only fields you'll see will come from the main search.

Don't limit the fields in the subsearch

0 Karma

asarolkar
Builder

that did not seem to do the trick.

It still gave me only everything on the left that matched.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...